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The European Data Protection Board 


Having regard to Article 70(1)(e) of the Regulation 2016/679/EU of the European Parliament and of 
the Council of 27 April 2016 on the protection of natural persons with regard to the processing of 
personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter 
“GDPR”), 


Having regard to the EEA Agreement and in particular to Annex XI and Protocol 37 thereof, as amended 
by the Decision of the EEA joint Committee No 154/2018 of 6 July 20187, 


Having regard to Article 12 and Article 22 of its Rules of Procedure, 


HAS ADOPTED THE FOLLOWING GUIDELINES 


1 GENERAL 


Within the cooperation mechanism set out by the GDPR, the supervisory authorities (“SAs”) have a 
duty to “exchange all relevant information with each other” and cooperate “in an endeavour to reach 
consensus”*. This duty of cooperation applies to every stage of the procedure, starting with the 
inception of the case and extending to the whole decision-making process. The achievement of an 
agreement on the outcome of the case is therefore the ultimate goal of the whole procedure 
established by Article 60 GDPR. In the situations in which no consensus is reached among the SAs, 
Article 65 GDPR entrusts the EDPB with the power to adopt binding decisions. However, the exchange 
of information and the consultation among the Lead Supervisory Authority (“LSA”) and the Concerned 
Supervisory Authorities (“CSAs”) often enables an agreement to be reached at the early stages of the 
case. 


According to Article 60(3) and (4)GDPR, the LSA is required to submit a draft decision to the CSAs, 
which then may raise a relevant and reasoned objection within a specific timeframe (four weeks)’. 
Upon receipt of a relevant and reasoned objection, the LSA has two options open to it. If it does not 
follow the relevant and reasoned objection or is of the opinion that the objection is not reasoned or 
relevant, it shall submit the matter to the Board within the consistency mechanism. If the LSA, on the 
contrary, follows the objection and issues the revised draft decision, the CSAs may express a relevant 
and reasoned objection on the revised draft decision within a period of two weeks. 


When the LSA does not follow an objection or rejects it as not relevant or reasoned and therefore 
submits the matter to the Board according to Article 65(1)(a) GDPR, it then becomes incumbent upon 
the Board to adopt a binding decision on whether the objection is “relevant and reasoned” and if so, 
on all the matters which are the subject of the objection. 


1 References to “Member States” made throughout this document should be understood as references to “EEA 
Member States”. 

2? Regulation 2016/679, hereinafter “GDPR”, Article 60(1). 

3 It is possible for the CSAs to withdraw objections previously raised. 
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Therefore, one of the key elements signifying the absence of consensus between the LSA and the CSAs, 
is the concept of “relevant and reasoned objection”. This document seeks to provide guidance with 
respect to this concept and aims at establishing a common understanding of the notion of the terms 
“relevant and reasoned”, including what should be considered when assessing whether an objection 
“clearly demonstrates the significance of the risks posed by the draft decision” (Article 4(24) GDPR). 


2 « RELEVANT AND REASONED » OBJECTION 


Article 4(24) GDPR defines “relevant and reasoned objection” as an objection to a draft decision as to 
whether there is an infringement of this Regulation, or whether envisaged action in relation to the 
controller or processor complies with this Regulation, which clearly demonstrates the significance of 
the risks posed by the draft decision as regards the fundamental rights and freedoms of data subjects 
and, where applicable, the free flow of personal data within the Union”. 


This concept serves as a threshold in situations where CSAs aim to object to a (revised) draft decision 
to be adopted by the LSA under Article 60 GDPR. As the unfamiliarity surrounding “what constitutes 
relevant and reasoned objection” has the potential to create misunderstandings and inconsistent 
applications by the supervisory authorities, the EU legislator suggested that the EDPB should issue 
guidelines on this concept (end of Recital 124 GDPR). 


An objection submitted by a CSA should indicate each part of the draft decision that is considered 
deficient, erroneous or lacking some necessary elements, either by referring to specific 
articles/paragraphs or by other clear indication, and showing why such issues are to be deemed 
“relevant” as further explained below. Therefore, the objection aims, first of all, at pointing out how 
and why according to the CSA the draft decision does not appropriately address the situation of 
infringement of the GDPR and/or does not envision appropriate action towards the controller or 
processor. The proposals for amendments put forward by the objection should aim to remedy these 
errors. 


Indeed, the degree of detail of the objection and the depth of the analysis included therein may be 
affected by the degree of detail in the content of the draft decision and by the degree of involvement 
of the CSA in the process leading to the draft decision issued by the LSA. Therefore, the standard of 
“relevant and reasoned objection” is grounded on the assumption that the LSA’s obligation to 
exchange all relevant information is complied with, allowing the CSA(s) to have an in-depth 
understanding of the case and therefore to submit a solid and well-reasoned objection. To this end, 
the need for each legally binding measure of SAs to “give the reasons for the measure” (see Recital 
129 GDPR) should also be kept in mind. The degree of involvement of the CSA in the process leading 
to the draft decision, if it leads to an insufficient knowledge of all the aspects of the case, can therefore 
be considered as an element to determine the degree of detail of the relevant and reasoned objection 
in a more flexible way. 


The EDPB would first like to emphasise that the focus of all SAs involved should be on eliminating any 
deficiencies in the consensus-building process in such a way that a consensual draft decision is the 
result. Whilst acknowledging that raising an objection is not the most preferable tool to remedy an 
insufficient degree of cooperation in the preceding stages of the OSS proceeding, the EDPB 
nevertheless acknowledges that it is an option open to CSAs. This would be a last resort to also remedy 
(alleged) deficiencies in terms of their involvement by the LSA in the process that should have led to a 
consensus-based draft decision, including as regards the legal reasoning and the scope of the 
investigations carried out by the LSA in respect of the case at hand. 
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The GDPR requires the CSA to justify its position on the draft decision by submitting an objection that 
is “relevant” and “reasoned”. It is crucial to bear in mind that the two requirements, “reasoned” and 
“relevant”, are to be deemed cumulative, i.e. both of them have to be met’. Consequently, Article 
60(4) requires the LSA to submit the matter to the EDPB consistency mechanism when it is of the 
opinion that the objection does not meet at least one of the two elements. 


The EDPB strongly advises the SAs to raise their objections and exchange information through the 
information and communication system set up for the exchange of information among SAs°. They 
should be clearly marked as such by using the specific dedicated functions and tools. 


2.1 “Relevant” 

In order for the objection to be considered as “relevant”, there must be a direct connection between 
the objection and the draft decision at issue’. More specifically, the objection needs to concern either 
whether there is an infringement of the GDPR or whether the envisaged action in relation to the 
controller or processor complies with the GDPR. 


Consequently, the objection raised fulfils the criterion of being “relevant” when, if followed, it would 
entail a change leading to a different conclusion as to whether there is an infringement of the GDPR 
or as to whether the envisaged action in relation to the controller or processor, as proposed by the 
LSA, complies with the GDPR. There must always be a link between the content of the objection and 
such potential different conclusion as further explained below. While it is possible for the objection to 
signal a disagreement on both elements, the existence of only one of them would be sufficient to meet 
the conditions for a relevant objection. 


An objection should only be considered relevant if it relates to the specific legal and factual content of 
the draft decision. Raising only abstract or broad comments or objections cannot be considered 
relevant in this context. 


Likewise, minor disagreements on the wording or regarding the legal reasoning that does not relate to 
the possible existence of the infringement nor to the compliance of envisaged action in relation to the 
controller or processor with the GDPR. 


The reasoning underlying the conclusions reached by the LSA in the draft decision can be the subject 
to an objection, but only insofar as such reasoning is linked with the conclusion as to whether there is 
an infringement - or whether the infringement of the GDPR has been correctly identified - or with the 
envisaged action, and to the extent that the whole Article 4(24) threshold as described in this 
document is met. 


2.2 “Reasoned” 

In order for the objection to be “reasoned”’, it needs to include clarifications and arguments as to why 
an amendment of the decision is proposed (i.e. the alleged legal / factual mistakes of the draft 
decision). It also needs to demonstrate how the change would lead to a different conclusion as to 


4 See the wording of Art. 60 (4). 

5 See the EDPB Rules of Procedure. 

6 The Oxford English Dictionary defines “relevant” as “bearing on or connected with the matter in hand; closely relating to the 
subject or point at issue; pertinent to a specified thing” ("relevant, adj." OED Online, Oxford University Press, June 2020, 
www.oed.com/view/Entry/161893. Accessed 24 July 2020). 

7 The Oxford English Dictionary defines “reasoned” as “characterised by or based on reasoning; carefully studied” ("reasoned, 
adj.2." OED Online, Oxford University Press, June 2020, www.oed.com/view/Entry/159078. Accessed 24 July 2020). 
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whether there is an infringement of the GDPR or whether the envisaged action in relation to the 
controller or processor complies with the GDPR. 


The CSA should provide sound reasoning for its objection, in particular, by reference to legal 
arguments (relying on EU law and/or relevant national law and including e.g. legal provisions, 
guidelines, case law) or factual arguments, where applicable. The CSA should present the fact(s) 
allegedly leading to a different conclusion regarding the infringement of the GDPR by the 
controller/processor, or the aspect of the decision that, in their view, is deficient/erroneous. 


Moreover, an objection is “reasoned” insofar as it is able to “clearly demonstrate” the significance of 
the risks posed by the draft decision as described in section 3.2 below. To this end, the objection must 
put forward arguments or justifications concerning the consequences of issuing a decision without the 
changes proposed in the objection, and how such consequences would pose significant risks. 


In order for an objection to be adequately reasoned, it should be coherent, clear, precise and detailed 
in explaining the reasons for objection. It should set forth, clearly and precisely, the essential facts on 
which the CSA based its assessment, and the link between the envisaged consequences of the draft 
decision (if it was to be issued ‘as is’) and the significance of the anticipated risks. Moreover, the CSA 
should clearly indicate which parts of the draft decision they disagree with. In cases where the 
objection is based on the opinion that the LSA failed to fully investigate an important fact of the case, 
or an additional violation of the GDPR, it would be sufficient for the CSA to present such arguments in 
a conclusive and substantiated manner. 


The CSA(s) must provide all the information (facts, documents, legal arguments) on which they are 
relying so as to effectively present their argument. This is fundamental in order to delimit the scope of 
the (potential) dispute. This means that, in principle, the CSA should aim to provide a relevant and 
reasoned objection in one single submission supported by all the factual and legal arguments as 
described above. However, within the deadline set forth by Article 60(4) GDPR the CSA can provide 
additional information related to the objection raised, or additional objections, bearing in mind the 
need to comply with the “relevant and reasoned” requirements. 








Example: The CSA submits a formal objection, but a few days later provides the LSA with additional 
information through the information and communication system regarding the facts of the case. Such 
information may only be taken into consideration by the LSA insofar as it is provided within the 
deadline set forth by Article 60(4) GDPR. 


If the additional information amounts to a new objection, it needs to meet the “relevant and reasoned” 
requirements described in this section and the CSA should submit the facts, documents and legal 
arguments supporting the additional information. 





If possible, as a good practice, the objection should include a new wording proposal for the LSA to 
consider, which in the opinion of the CSA allows to remedy the alleged infringement. This may serve 
to clarify the objection better in the relevant context. 


3 CONTENT OF THE OBJECTION 


The subject matter of the objection may refer to whether there is an infringement of the GDPR and/or 
to whether the envisaged action in relation of the controller or the processor complies with the GDPR. 
The type of content will depend on the specific draft decision at issue and on the circumstances of the 
case. 
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Additionally, the CSA’s objection will have to clearly demonstrate the significance of the risks posed by 
the draft decision as regards the fundamental rights and freedoms of data subjects and, where 
applicable, the free flow of personal data within the Union. The existence of an infringement and/or 
the non-compliance of the envisaged action should be assessed in light of the significance of the risks 
that the draft decision, if left unchanged, poses to the rights and freedoms of data subjects and, if 
relevant, the free flow of personal data. 


3.1 Existence of an infringement of the GDPR and/or compliance of the envisaged 
action with the GDPR 


3.1.1 Existence of an infringement of the GDPR 

In the first case, the content of the objection will amount to a disagreement between the CSA and the 
LSA as to whether, in the facts at issue, the activities and processing operations carried out by the 
controller or processor led to an infringement of the GDPR or not, and to which infringement(s) 
specifically. 


In this context, the term “infringement” should be interpreted as “an infringement of a given provision 
of the GDPR”. Therefore, the CSA’s objections to the draft decision must be justified and motivated 
through reference to evidence and facts that support the objection, by having regard to the facts and 
evidence (the ‘relevant information’ referred to in Article 60.3) provided by the LSA. These 
requirements should apply to each specific infringement and to each specific provision in question (e.g. 
if the draft decision says that the controller infringed Articles 6, 7, and 14 GDPR, and the CSA disagrees 
on whether there is an infringement of Article 7 and 14 and considers that there is an infringement of 
Article 13 GDPR). 








Example: For instance, the CSA argues that the household exemption is not applicable to some of the 
processing operations conducted by a data controller and involving the use of CCTV. The LSA did not 
take this into consideration. In order to justify its objection, the CSA refers to Article 2(2)(c) GDPR, 
EDPB Guidelines 3/2019 on processing of personal data through video devices, and CJEU case C-212/13 
Ryneš. 





An objection as to whether there is an infringement of the GDPR may also include a disagreement as 
to the conclusions to be drawn from the findings of the investigation. For instance, the objection may 
state that the findings amount to the infringement of a provision of the GDPR other than (and/or in 
addition to) those already analysed by the draft decision. However, this is less likely to happen when 
the obligation for the lead supervisory authority to cooperate with the concerned supervisory 
authorities and exchange all relevant information has been duly complied with in the time preceding 
the issuance of the draft decision. 


In some circumstances, the objection could go as far as identifying gaps in the draft decision justifying 
the need for further investigation by the LSA. For instance, if the investigation carried out by the LSA 
unjustifiably fails to cover some of the issues raised by the complainant or resulting from an 
infringement reported by a CSA, a relevant and reasoned objection may be raised based on the failure 
of the LSA to properly handle the complaint and in safeguarding the rights of the data subject. In this 
regard, a distinction must be made between, on one hand, own-volition inquiries and, on the other 
hand, investigations triggered by complaints or by reports on potential infringements shared by 
concerned supervisory authorities. In procedures based on a complaint or on an infringement reported 
by a CSA, the scope of the procedure (i.e. those aspects of data processing which are potentially the 
subject of a violation) should be defined by the content of the complaint or the CSA reporting, in other 
words by the aspects the complaint or report aims at. In ex officio procedures, the SAs should seek 
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consensus regarding the scope of the procedure (i.e. the aspects of data processing under scrutiny) 
prior to initiating the procedure formally. As mentioned above, raising an objection should only be 
considered as a last resort to remedy an allegedly insufficient involvement of the CSA(s) in the 
preceding stages of the process. The system designed by the legislator suggests that consensus on the 
scope of the investigation should be reached at an earlier stage by the competent supervisory 
authorities. 


The insufficient factual information or description of the case at stake, or the absence or insufficiency 
of assessment or reasoning (with the consequence that the conclusion in the draft decision is not 
adequately supported by the assessment carried out and the evidence presented, as required in Article 
58 GDPR), can also be a matter of objection linked to the existence of an infringement, as long as the 
whole threshold set forth by Art. 4(24) GDPR is met and it is possible that there can be a link between 
such allegedly insufficient analysis and the finding of an infringement / the envisaged action. 


It is possible for a relevant and reasoned objection to raise issues concerning procedural aspects to the 
extent that they amount to situations in which the LSA allegedly disregarded procedural requirements 
imposed by the GDPR and this affects the conclusion reached in the draft decision. 





Example: The supervisory authority of Member State YY is competent to act as lead supervisory 
authority for the cross-border processing carried out by the controller CC whose main establishment 
is in YY. The competent supervisory authority of Member State XX informs the lead supervisory 
authority (YY) concerning a complaint lodged with the XX SA substantially affecting data subjects only 
in XX, pursuant to Article 56(2) and (3) GDPR. The lead supervisory authority YY decides to handle the 
case. The supervisory authority of XX decides to submit to the YY SA a draft pursuant to Article 56(4). 
The lead supervisory authority prepares a draft decision pursuant to Article 60(3) GDPR and submits it 
to the concerned supervisory authorities. The XX SA raises a relevant and reasoned objection 
concerning the fact that the YY SA should have taken utmost account of the draft received from the XX 
SA, pursuant to Article 56(4) GDPR. The objection puts forward arguments clarifying the different 
conclusion that the draft decision would have reached if the YY SA had complied with its procedural 
obligation imposed by Article 56(4) GDPR. 











An objection pursuant to Art. 60(4) / 65(1)(a) is without prejudice to the provision of Art. 65(1)(b). 
Therefore, a disagreement on the competence of the supervisory authority acting as lead supervisory 
authority to issue a decision in the specific case should not be raised through an objection pursuant to 
Article 60(4) and falls outside of the scope of Article 4(24); unlike the objection pursuant to Art. 60(4), 
the EDPB considers the procedure pursuant to Art. 65(1)(b) to be applicable at any stage. 


3.1.2 Compliance of the action envisaged in the draft decision in relation to the controller or 
processor with the GDPR 

In this second scenario, the content of the relevant and reasoned objection amounts to a disagreement 

regarding the particular corrective measure proposed or other action envisaged in the draft decision. 


More specifically, the relevant and reasoned objection should explain why the action foreseen in the 
draft decision is not in line with the provisions of the GDPR. To this end, the CSA must clearly set out 
its factual and/or legal arguments underlying the different assessment of the situation, by indicating 
which action would be appropriate for the LSA to undertake and include in the final decision. 





| Example 1: The controller disclosed sensitive medical data of the complainant to a third party without | 
| a legal basis. In the draft decision, the LSA proposed to issue a reprimand, while the CSA provides | 
factual arguments showing that the controller is facing broad and systemic issues in its compliance 
with the GDPR (e.g. it regularly discloses the clients’ data to third parties). Therefore, it proposes that 
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the order to bring processing operations into compliance/a temporary ban on data processing or a fine 
should be imposed. 


Example 2: Due to a mistake of one of its employees, the controller published the name, last name 
and telephone numbers of all its 100.000 clients on its website. These personal data were publicly 
accessible for two days. As the controller reacted as soon as possible, the mistake was reported, and 
all the clients were individually informed, the LSA planned to issue a reprimand. One CSA however 
considers that, due to the large scale of the data breach and its possible impact/risk on the private life 
of the clients, the imposition of a fine would be required. 








As enshrined in the last sentence of Art. 65 (1)(a) the binding decision of the EDPB shall concern all the 
matters which are subject of the objection, in particular in case of an infringement. Recital 150 
sentence 5 states that the consistency mechanism may also be used to promote a consistent 
application of administrative fines. Therefore, it is possible that the objection challenges the elements 
relied upon to calculate the amount of the fine. If the assessment identifies causal shortcomings, the 
LSA will be instructed to remit the fine, by eliminating the shortcomings within a given financial 
framework appropriate to the case. This assessment should be based on common EDPB standards 
stemming from Art. 83(1) and (2) GDPR and the Guidelines on the calculation of administrative fines. 





Example: The CSA considers that the level of the fine envisaged by the LSA in the draft decision is not | 
effective, proportionate or dissuasive, as required by Article 83(1) GDPR, taking account of the facts of 
the case. 





3.2 Significance of the risks posed by the draft decision 


3.2.1 Meaning of “significance of the risks” 

It is important to bear in mind that the goal of the work carried out by SAs is that of protecting the 
fundamental rights and freedoms of natural persons and facilitating the free flow of personal data 
within the Union (Articles 4(24), 51 GDPR and Recital 123). 


The obligation to demonstrate the significance of the risk posed by the draft decision (e.g. by the 
measures provided for therein, by the absence corrective measures, etc.) for rights and freedoms of 
data subjects and/or the free flow of data lies on the CSA. The possibility for CSAs to provide such a 
demonstration will also rely on the degree of detail of the draft decision itself and of the previous 
exchange of information, as highlighted above. 


“Risk” is mentioned in numerous sections of the GDPR and previous EDPB guidelines® define it as “a 
scenario describing an event and its consequences, estimated in terms of severity and likelihood”. 
Article 4(24) GDPR refers to the need to demonstrate the “significance” of the risks posed by the draft 
decision, that is, to show the implications the draft decision would have for the protected values. The 
CSA will need to do so by advancing sufficient arguments to show that such risks are substantial and 
plausible. 


While a relevant and reasoned objection needs to always clearly demonstrate the significance of the 
risks posed by the draft decision as regards the fundamental rights and freedoms of data subjects (see 
Section 3.2.2), the demonstration of risks posed to the free flow of personal data within the European 
Union is only requested “where applicable” (see below Section 3.2.3). 





8 See e.g. WP 248 rev.01 Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is 
“likely to result in a high risk” for the purposes of Regulation 2016/67. 
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3.2.2 Risks to fundamental rights and freedoms of data subjects 

The issue at stake concerns the impact the draft decision as a whole would have on the data subjects’ 
rights and fundamental freedoms. This may concern the findings the LSA made as to whether the 
controller or processor breached the GDPR and/or the imposition of corrective measures. 


The approach to assessing the risk posed by the draft decision is not the same as that applied by a 
controller in carrying out a DPIA to establish the risk of an intended processing operation, since the 
subject matter of the assessment is totally different: namely, the effects produced by the conclusions 
drawn by the LSA as set out in the draft decision regarding an infringement that has been found to 
have been committed/not to have been committed. Those conclusions may entail the taking of certain 
measures (the 'envisaged action’). As said, it is by having regard to the draft decision as a whole that 
such risk is to be demonstrated by the CSA. 


Recital 129 of the GDPR clarifies that “[t]he powers of supervisory authorities should be exercised in 
accordance with appropriate procedural safeguards set out in Union and Member State law, 
impartially, fairly and within a reasonable time” and that “each measure should be appropriate, 
necessary and proportionate in view of ensuring compliance with this Regulation, taking into account 
the circumstances of each individual case, respect the right of every person to be heard before any 
individual measure which would affect him or her adversely is taken and avoid superfluous costs and 
excessive inconveniences for the persons concerned”. 


Therefore, the evaluation of the risks posed by the draft decision to the rights and freedoms of data 
subjects can rely, inter alia, on the appropriateness, necessity, and proportionality of the measures 
envisaged (or not envisaged) therein as based on the findings related to the existence of an 
infringement and the possible remedial actions set forth by the controller / processor. 


Additionally, the risks at stake may refer to the impact of the draft decision on the fundamental rights 
and freedoms of the data subjects whose personal data are processed by the controller, but also to 
the impact on the rights and freedoms of data subjects whose personal data might be processed in the 
future and to the possible reduction of future infringements of the GDPR. 








Example: The draft decision concluded that the principle of data minimisation enshrined in Article 
5(1)(c) GDPR was not breached. The CSA brings factual and legal arguments to show the processing 
activity carried out by the controller had resulted in a breach of Article 5(1)(c) and to argue that a 
reprimand should be issued against the controller. In order to demonstrate the significance of the risks 
for the rights and freedoms of data subjects, the CSA argued that the absence of a reprimand for the 
violation of a fundamental principle would amount to a dangerous precedent, sending a deceiving 
message to the market and to data subjects, and would endanger the data subjects whose personal 
data are and will be processed by the controller. 





3.2.3 Risks to free flow of personal data within the Union 

Where the objection will refer to this particular risk, the CSA will need to clarify why it is deemed to be 
“applicable”. Additionally, an objection demonstrating risks posed to the free flow of personal data, 
but not to the rights and freedoms of data subjects, will not be considered as meeting the threshold 
set by Article 4(24) GDPR. 


The need to avoid restricting or prohibiting the free movement of personal data for reasons connected 
with the protection of natural persons with regard to the processing of personal data is explicitly 
recalled by the GDPR®, which aims to introduce harmonised data protection rules across the EU and 





9 GDPR, Article 1(3). 
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enable the free flow of personal data within the Union, while ensuring a high level of the protection of 
personal data. 


The risks to the free flow of data may be created by any measures, including decisions of national SAs, 
which introduce unjustified limitations regarding data storage (e.g. provisions which oblige a controller 
to store certain information in a particular Member State) and/or the free flow of personal data 
between the Member States (e.g. through suspension of data flows or imposition of temporary or 
definitive limitation including a ban on processing). 


Likewise, the free flow of data may be at risk when expectations are set (or requirements imposed) on 
how controllers fulfil their obligations under the GDPR, namely in such a way that it becomes tied to a 
specific region in the EU (e.g. through language requirements, specific qualifications requirements). 


Additionally, the free flow of personal data may also be hampered if unjustifiably different decisions 
are issued by SAs in situations that are identical or similar (e.g. in terms of sector or type of processing); 
this lack of uniformity would endanger the EU level playing field and create contradictory situations 
within the EU and the risk of forum shopping. 
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